On Tuesday, wallets connected to the $295.7 million Drift Protocol exploit transferred 25,700 Ethereum, worth $61.56 million, to the mixing service Tornado Cash. Blockchain data from Arkham shows the attacker's 71 tracked addresses still hold 81,454 ETH valued at nearly $198 million. The April attack on Drift's Solana exchange was attributed to North Korean cyber group UNC6862. Meanwhile, victims have opened claims but are receiving about a penny for every dollar lost from a recovery pool containing roughly 3.1 million USDT.
The wallets had been quiet for about two months before Tuesday's burst. Transfers arrived in batches of 100 ETH (about $237,800 each) and smaller 10 ETH chunks, matching Tornado Cash's fixed deposit pools. The deposits follow an earlier round on July 23 and 24, when an address labeled Drift Exploiter 4 sent about 23,095 ETH, then worth around $44.4 million, into the same mixer.
According to Drift, the attacker made off with $295.7 million after gaining admin powers on the platform, introducing a fake token, and using it to borrow real liquidity. The stolen funds included $159.3 million in Jupiter Liquidity Provider tokens and $71.4 million in USDC, most of which was later swapped and bridged to Ethereum. Drift said the attacker posed as a quantitative trading firm, met contributors in person, and deposited $1 million of its own money to build trust. The forensic firm Mandiant attributed the attack to UNC6862, a North Korean threat group.
Drift, whose relaunched exchange now runs as Velocity, opened claims for its recovery pool on October 1, issuing one token for every USDT of verified loss, about 299.5 million in total. The pool held roughly 3.1 million USDT at launch, so early redemptions paid about 0.0104 USDT per token, or approximately a penny on the dollar. The pool receives a daily cut of between 60% and 90% of Velocity's net protocol revenue, scaling with revenue growth. Tether has committed up to 127.5 million USDT toward the recovery. Any stolen funds recovered through freezes, the bounty, or law enforcement also flow into the pool.
A quirk noted by Arkham: the exploiter's tracked holdings still include exactly one Fartcoin, worth about 15 cents, far from the $4.1 million in Fartcoin that Drift says was taken in April.
Analysis
Why This Matters
- The movement of funds through Tornado Cash indicates the attacker is actively laundering the proceeds of one of the largest DeFi exploits on Solana, making recovery harder.
- The minimal payout from the recovery pool highlights the limited recourse for victims of crypto thefts, even with additional commitments from Tether.
- The remaining $198 million in ETH represents a significant overhang that could affect markets if the attacker chooses to sell or deposit further.
Background
The Drift Protocol exploit occurred in April on the Solana blockchain. The attacker gained administrative privileges, introduced a fake token, and used it to borrow real liquidity from the platform. Drift later attributed the attack to UNC6862, a North Korean cyber threat group, after an investigation by Mandiant. The attacker bridged stolen funds to Ethereum and has now sent over $100 million combined in two batches to Tornado Cash, a cryptocurrency mixer that has been under US sanctions.
Following the exploit, Drift relaunched as Velocity and set up a recovery pool funded by daily protocol revenue and a commitment from Tether of up to 127.5 million USDT. Claims opened on October 1.
Key Perspectives
[Victims of the exploit]: Users who lost funds face a recovery that has so far paid about one cent per dollar, with the pool initially holding only 3.1 million USDT against total verified losses of $295.7 million.
[US law enforcement]: The use of Tornado Cash, a sanctioned mixer, to launder the proceeds could bring additional legal scrutiny. Any frozen funds or bounty recoveries are allocated to the recovery pool.
[The crypto industry]: The incident highlights persistent vulnerabilities in DeFi smart contracts and the challenges of tracing and recovering stolen assets.
What to Watch
- Whether the attacker continues to move the remaining $198 million in ETH through mixers or exchanges.
- The growth of the recovery pool as Velocity nets 60-90% of its daily revenue.
- Any further attribution or enforcement actions from authorities.
